What Is Confirmed
Microsoft’s Security Blog disclosed two vulnerabilities in Semantic Kernel, the company’s open-source agent orchestration framework, according to a post published May 7, 2026. Both vulnerabilities involve prompt injection — the technique of embedding malicious instructions inside content an AI model processes — escalating to remote code execution (RCE) on the host system running the agent.
According to Microsoft’s disclosure, the root issue is architectural: Semantic Kernel, like most agent frameworks, allows AI models to invoke tools, plugins, and code interpreters in response to natural-language instructions. When an attacker controls the content the model processes — a document, a web page, an API response — that attacker can craft instructions that redirect the agent to execute arbitrary code on the underlying host. The model itself is not a security boundary, and the Semantic Kernel vulnerabilities make that concrete.
Microsoft confirmed the vulnerabilities and published the advisory. No additional independent confirmation of technical specifics beyond Microsoft’s own disclosure was available at the time this item was checked.
What Is Reported (Not Confirmed)
The Microsoft Security Blog describes how prompt injection crosses from an output-quality problem — the model says something it shouldn’t — into a code-execution primitive. The post argues that defenders must correlate signals at both the model layer and the host layer, because a model-level content filter alone will not catch an attack that succeeds by manipulating the model’s tool-calling behavior rather than its text output.
It is not confirmed whether these specific vulnerabilities have been exploited in the wild. Microsoft’s disclosure does not assert active exploitation, and no third-party threat intelligence reporting corroborating in-the-wild exploitation was available as of the last-checked date below. Patch or mitigation status beyond the disclosure itself has not been independently verified by InfoDefenders.
The broader class of vulnerability — prompt injection leading to agent-level code execution — is not unique to Semantic Kernel. Similar attack patterns have been documented against other LLM agent frameworks, though specific CVEs and severity ratings for those analogous cases are not part of this disclosure and should be sourced separately.
Why This Matters for IT Governance
For IT managers at companies that have deployed AI agents — or are evaluating them — this disclosure is a useful forcing function. The threat model for an AI agent is not the same as the threat model for a SaaS application. A SaaS app runs code its developers wrote. An AI agent runs code that its model, responding to inputs from the outside world, decides to run. That’s a materially different attack surface, and most vendor risk assessments haven’t caught up to it yet.
If your organization is running Semantic Kernel-based agents, verify your patch status against Microsoft’s advisory directly. More broadly, if you haven’t inventoried which AI tools and agent frameworks are in use across your environment — including what external content those agents are permitted to ingest — that gap is now a documented security risk, not just a governance gap.
A good starting point is a formal AI tool register that captures not just what AI tools are deployed but what data they access, what actions they can take, and who owns them. That level of visibility is what separates organizations that can respond to a disclosure like this in hours from those that spend days figuring out whether they’re even affected.
If you don’t have that register in place yet, download the free AI tool register template — it covers the fields you need to answer that question quickly.
Last Checked
2026-09-09 22:48 UTC